Cyprus Connect holds confidential material for lawyers, accountants and compliance teams. This page explains how we protect it and which laws and standards we follow. For the contractual version of these measures, see Annex 2 of the Data Processing Agreement.
1. Encryption
- End-to-end encrypted Vault. Files and file names are encrypted in the user's browser before upload with AES-256-GCM, using a separate key for every file. File keys are wrapped with each authorised user's RSA-OAEP 3072-bit public key. Private keys are protected by the user's passphrase (PBKDF2-SHA256, 600,000 iterations) and never leave the browser unencrypted. The server stores only encrypted data, so neither we nor anyone who gains access to the server can read Vault files.
- In transit. All connections use HTTPS with TLS 1.2 or 1.3 and HTTP Strict Transport Security.
- At rest. Authenticator secrets are encrypted; passwords are stored only as salted hashes; backups are encrypted.
2. Identity and access
- Two-step sign-in for every user: password plus a code from an authenticator app, with a backup code by email. An app code can be used for one sign-in only.
- Private and locked folders need a fresh one-time code each time the Vault is opened, with an optional folder password on top.
- Automatic lock after 10 minutes of inactivity, separately for each person.
- Rights are set per user by the firm's admin lawyer; every firm is approved before access is switched on.
- Server administration only through SSH keys; password and root password logins are disabled.
3. Protection against attacks
- Rate limits on sign-in, sign-up, codes and contact forms, in the application and the web server.
- Automatic banning of IP addresses after repeated failed sign-ins to the application or SSH, and of known bad bots and scanners (fail2ban), with longer bans for repeat offenders.
- Firewall that allows only web traffic and SSH.
- Strict Content Security Policy, protection against cross-site request forgery, clickjacking and content sniffing.
- Uploaded files are checked by their actual content; executable files and Office files with macros are refused.
- The ComplyGuard website scanner cannot reach private or internal networks.
4. Monitoring, integrity and resilience
- Activity log for each firm covering sign-ins, views, downloads, prints, copies, moves, edits and deletions.
- Server security logs, automatic security updates, and regular rootkit and file-integrity scans.
- Encrypted daily backups with a 14-day retention period.
- Services run in isolated containers that restart automatically on failure.
5. Data protection by design
- Documents checked by ComplyGuard are read in memory and deleted immediately; only the results are kept.
- Screening details are masked on screen 60 minutes after a search.
- AI research receives only text that has been masked and approved by a lawyer.
- No advertising or analytics tools load without consent.
6. Laws and frameworks we follow
| Framework | How it applies |
|---|---|
| GDPR (EU) 2016/679 and Cyprus Law 125(I)/2018 | We are controller for account data and processor for customer data, with an Article 28 DPA. |
| ePrivacy Directive and Cyprus Law 112(I)/2004 | Optional cookies only with prior consent; see the Cookie Policy. |
| NIS2 Directive (EU) 2022/2555 and Cyprus Law 89(I)/2020 as amended by Law 60(I)/2025 | We follow its risk-management measures as good practice and monitor whether we fall within scope. See EU Cybersecurity Act and CRA. |
| Cyber Resilience Act (EU) 2024/2847 | We apply its principles of secure by design, vulnerability handling and coordinated disclosure. |
| ISO/IEC 27001:2022 | Our security controls are designed with reference to ISO/IEC 27001. Cyprus Connect is not certified under this standard. |
7. Your part
Security is shared. Keep passphrases, recovery keys and phones safe, remove users who leave, and review your activity log. Report suspected incidents to security@cyprusconnect.net.
Topify Consulting Ltd, registration no. HE 409159, VAT no. 10409159B, Alkyonis 1, 3087 Limassol, Cyprus. Contact: info@cyprusconnect.net. If a translation of this document differs from the English version, the English version applies.